PERSONAL DATA PROCESSING CONDITIONS
I. Basic Provisions
1. The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR”) is Boxdepo s.r.o., with registered office at Praha 5, Hlubočepy, Högerova 686/6, ZIP code 152 00, Company ID No.: 22400125, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 416175.
2. Controller contact details:
Email: info@boxdepo.eu
Tel.: +420 736 761 648
3. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
II. Sources and Categories of Personal Data Processed
1. The controller processes personal data obtained when you visit the website boxdepo.eu, specifically data relating to your behaviour on the website, so-called cookies.
2. The controller processes personal data that you have provided or that the controller obtained based on your request for an offer or conclusion of a contract through the website boxdepo.eu, including:
• first and last name
• date of birth
• email address
• postal address
• telephone number
• company ID number and VAT number
3. The controller processes identification and contact data and data necessary for contract performance for the purposes stated below.
III. Legal Basis and Purpose of Personal Data Processing
1. The legal basis for processing personal data is:
• consent of the data subject pursuant to Article 6(1)(a) GDPR,
• legitimate interest of the controller pursuant to Article 6(1)(f) GDPR,
• taking steps prior to contract conclusion pursuant to Article 6(1)(b) GDPR,
• performance of a contract between you and the controller pursuant to Article 6(1)(b) GDPR,
• compliance with a legal obligation of the controller pursuant to Article 6(1)(c) GDPR.
2. The purposes of processing personal data are:
• improvement of the website,
• preparation of statistics and reports regarding website usage,
• processing your request to conclude a lease contract for a container storage unit with the controller and exercising rights and obligations arising from the contractual relationship; personal data required for successful order processing (name, date of birth, address, contact details) are necessary for contract conclusion and performance; without providing personal data, the contract cannot be concluded or performed,
• compliance with legal obligations towards state authorities,
• sending commercial communications by email relating to the controller’s own services.
3. The controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.
IV. Data Retention Period
1. Personal data obtained via cookies are stored for the period necessary to protect the controller’s legitimate interests (52 months from your last visit to the website).
2. Personal data are stored for the period necessary to exercise rights and obligations arising from the contractual relationship and to assert claims arising from these contractual relationships (for 5 years after termination of the contractual relationship).
3. After expiration of the retention period, personal data are deleted.
V. Recipients of Personal Data (Controller’s Subcontractors)
1. Recipients of personal data are persons participating in the delivery of goods/services or payment processing under a contract.
2. The controller does not intend to transfer personal data to a third country (outside the EU) or to an international organisation.
VI. Rights of the Data Subject
1. Under applicable legal conditions, the customer has the right to:
• access personal data,
• rectification of personal data,
• erasure of personal data,
• object to processing,
• request cessation of commercial communications,
• data portability,
• lodge a complaint with the Data Protection Authority if the data subject believes their data protection rights have been violated.
VII. Personal Data Security
1. The controller declares that it has adopted all appropriate technical and organisational measures necessary to secure personal data.
2. The controller has adopted technical measures to secure personal data storage, especially password-protected access to computers, use of antivirus software, and regular maintenance of computer systems.
VIII. Final Provisions
1. By submitting an electronic request through the website r3group.cz, the data subject confirms that they have been acquainted with the personal data protection conditions and accept them in full.
2. The controller is entitled to change these Rules at any time and is obliged to publish the new version on its website.
3. These Rules become effective on 1 March 2026.